Arbitrary File Upload

Overview notrinos/notrinos-erp is a web-based enterprise management system that is written in PHP and MySql. NotrinosERP contains all the required modules for running any small to medium size businesses. It supports multi users, multi currencies, multi languages. Affected versions of this package...

PT-2026-127194

Summary An authenticated user with the HR "Manage Employees" permission SA EMPLOYEE can upload a file with an arbitrary extension through the employee Documents tab. The handler writes the raw client-supplied filename — extension intact — into a web-served directory with no extension, MIME, or...